Merge pull request #7 from SentinalFS/feat/fullFilePath

feat: Preparation for getting full path in user space

Author: technoBlogger-2001

.vscode/settings.json

@@ -21,6 +21,7 @@
 		"data_types.h": "c",
 		"chrono": "c",
 		"text_encoding": "c",
-		"typeinfo": "c"
+		"typeinfo": "c",
+		"utils.h": "c"
 	}
 }

common.h

@@ -6,6 +6,7 @@
 #include "helpers/read_write.h"
 #include "helpers/rename.h"
 #include "helpers/delete.h"
+#include "utils/utils.h"
 // Common includes and definitions can stay here
 
 #endif /* COMMON_H */

data_types.h

@@ -3,6 +3,8 @@
 
 #include "headers.h"
 
+// Lets match parent/filename & inode with data in crds
+
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
     __uint(max_entries, 512 * 1024);
@@ -13,24 +15,12 @@ struct {
     __uint(max_entries, 256 * 1024);
 } rename_events SEC(".maps");
 
-struct
-{
-    __uint(type, BPF_MAP_TYPE_HASH);
-    __type(key, struct inode_key);
-    __type(value, u32);
-    __uint(max_entries, 256);
-} monitored_inodes SEC(".maps");
-
-
-struct inode_key
-{
-    u32 inode;
-};
-
 struct data_t
 {
     u32 pid;
     u32 uid;
+    u64 inode;
+    char parent_filename[FILE_NAME_SIZE];
     char filename[FILE_NAME_SIZE];
     char comm[COMM_SIZE];
     u64 timestamp;
@@ -42,6 +32,10 @@ struct rename_data_t
 {
     u32 pid;
     u32 uid;
+    u32 inode_old;
+    u32 inode_new;
+    char new_parent_filename[FILE_NAME_SIZE];
+    char old_parent_filename[FILE_NAME_SIZE];
     char old_filename[FILE_NAME_SIZE];
     char new_filename[FILE_NAME_SIZE];
     char comm[COMM_SIZE];

headers.h

@@ -7,9 +7,10 @@
 #include <bpf/bpf_tracing.h>
 #include <bpf/bpf_endian.h>
 
-#define FILE_NAME_SIZE 144
+#define FILE_NAME_SIZE 176
 #define OTYPE_SIZE 16
 #define COMM_SIZE 32
 #define DCACHE_NEGATIVE_DENTRY 0x0020
+#define NEGATIVE_INODE_NUMBER -1
 
 #endif

helpers/delete.h

@@ -3,55 +3,82 @@
 
 #include "../headers.h"
 #include "../data_types.h"
+#include "../utils/utils.h"
 
 static __always_inline int trace_file_delete(struct pt_regs *ctx, struct dentry *de)
 {
     if (!de)
     {
-        bpf_trace_printk("trace_file_delete: dentry is NULL\n", sizeof("trace_file_delete: dentry is NULL\n"));
         return 0;
     }
 
     struct data_t *data = bpf_ringbuf_reserve(&events, sizeof(struct data_t), 0);
     if (!data)
     {
-        bpf_trace_printk("trace_file_delete: failed to reserve ringbuf\n", sizeof("trace_file_delete: failed to reserve ringbuf\n"));
         return 0;
     }
     __builtin_memset(data, 0, sizeof(*data));
 
+    // specify the operation type
+    char OPRN[] = "DELETE";
+
+    // Read filename from dentry
     struct qstr d_name_qstr = {};
     bpf_core_read(&d_name_qstr, sizeof(d_name_qstr), &de->d_name);
-
     if (d_name_qstr.len <= 0 || !d_name_qstr.name || d_name_qstr.name == (void *)-1UL || d_name_qstr.name == NULL)
     {
-        bpf_ringbuf_discard(data, 0);
-        return 0;
+        DISCARD_AND_RETURN(data);
     }
 
+    // Get parent dentry
+    struct dentry *parent_de = NULL;
+    bpf_core_read(&parent_de, sizeof(parent_de), &de->d_parent);
+    if (!parent_de)
+    {
+        DISCARD_AND_RETURN(data);
+    }
+
+    // Read parent filename from parent dentry
+    struct qstr parent_d_name_qstr = {};
+    bpf_core_read(&parent_d_name_qstr, sizeof(parent_d_name_qstr), &parent_de->d_name);
+    if (parent_d_name_qstr.len <= 0 || !parent_d_name_qstr.name || parent_d_name_qstr.name == (void *)-1UL || parent_d_name_qstr.name == NULL)
+    {
+        DISCARD_AND_RETURN(data);
+    }
+
+    // Check for negative dentries
+    unsigned char d_parent_flags = 0;
     unsigned char d_flags = 0;
+    bpf_core_read(&d_parent_flags, sizeof(d_parent_flags), &parent_de->d_flags);
     bpf_core_read(&d_flags, sizeof(d_flags), &de->d_flags);
-    if (d_flags & DCACHE_NEGATIVE_DENTRY) {
-        bpf_trace_printk("trace_file_delete: negative dentry detected (file likely non-existent). Discarding.\n", sizeof("trace_file_delete: negative dentry detected (file likely non-existent). Discarding.\n"));
-        bpf_ringbuf_discard(data, 0);
-        return 0;
+    if ((d_parent_flags & DCACHE_NEGATIVE_DENTRY) || (d_flags & DCACHE_NEGATIVE_DENTRY)) {
+        bpf_trace_printk("Negative dentry detected: parent flags: %u, dentry flags: %u\n", d_parent_flags, d_flags);
+        DISCARD_AND_RETURN(data);
     }
 
-    char fname[FILE_NAME_SIZE] = {};
-    bpf_core_read_str(fname, sizeof(fname), d_name_qstr.name);
+    // Get the inode number
+    struct inode *inode_ptr = NULL;
+    bpf_core_read(&inode_ptr, sizeof(inode_ptr), &de->d_inode);
+    if (inode_ptr)
+        bpf_core_read(&data->inode, sizeof(data->inode), &inode_ptr->i_ino);
+    else
+        data->inode = NEGATIVE_INODE_NUMBER;
 
-    char OPRN[] = "DELETE";
-    __builtin_memcpy(data->filename, fname, sizeof(data->filename));
-    __builtin_memcpy(data->otype, OPRN, sizeof(data->otype));
+    // Get cgroup ID
+    int cgroup_id = bpf_get_current_cgroup_id();
+
+    // Copy data into the data structure
     data->pid = bpf_get_current_pid_tgid() >> 32;
     data->uid = bpf_get_current_uid_gid();
     data->timestamp = bpf_ktime_get_ns();
-    
-    bpf_get_current_comm(&data->comm, sizeof(data->comm));
-
-    int cgroup_id = bpf_get_current_cgroup_id();
     data->cgroup_id = cgroup_id;
 
+    bpf_core_read_str(data->filename, sizeof(data->filename), d_name_qstr.name);
+    bpf_core_read_str(data->parent_filename, sizeof(data->parent_filename), parent_d_name_qstr.name);
+    __builtin_memcpy(data->otype, OPRN, sizeof(data->otype));
+
+    bpf_get_current_comm(&data->comm, sizeof(data->comm));
+
     bpf_ringbuf_submit(data, 0);
     return 0;
 }

helpers/read_write.h

@@ -3,19 +3,22 @@
 
 #include "../headers.h"
 #include "../data_types.h"
+#include "../utils/utils.h"
 
 static __always_inline int trace_file_operation(struct pt_regs *ctx, struct file *file, const char *operation)
 {
     if (!file)
         return 0;
 
+    // Declare the ring buffer for events
     struct data_t *data = bpf_ringbuf_reserve(&events, sizeof(struct data_t), 0);
     if (!data)
     {
         return 0;
     }
     __builtin_memset(data, 0, sizeof(*data));
 
+    // Check if the file pointer is valid, get the dentry from the file structure
     struct dentry *de = NULL;
     bpf_core_read(&de, sizeof(de), &file->f_path.dentry);
     if (!de)
@@ -24,6 +27,7 @@ static __always_inline int trace_file_operation(struct pt_regs *ctx, struct file
         return 0;
     }
 
+    // Get filename
     struct qstr d_name = {};
     bpf_core_read(&d_name, sizeof(d_name), &de->d_name);
     if (d_name.len == 0)
@@ -32,17 +36,25 @@ static __always_inline int trace_file_operation(struct pt_regs *ctx, struct file
         return 0;
     }
 
-    char fname[FILE_NAME_SIZE] = {};
-    bpf_core_read_str(fname, sizeof(fname), d_name.name);
-
-    data->pid = bpf_get_current_pid_tgid() >> 32;
-    data->uid = bpf_get_current_uid_gid();
-    data->timestamp = bpf_ktime_get_ns();
+    // Get parent dentry
+    struct dentry *parent_de = NULL;
+    bpf_core_read(&parent_de, sizeof(parent_de), &de->d_parent);
+    if (!parent_de)
+    {
+        bpf_ringbuf_discard(data, 0);
+        return 0;
+    }
 
-    __builtin_memcpy(data->filename, fname, sizeof(data->filename));
-    __builtin_memcpy(data->otype, operation, sizeof(data->otype));
-    bpf_get_current_comm(&data->comm, sizeof(data->comm));
+    // Get parent filename
+    struct qstr parent_d_name = {};
+    bpf_core_read(&parent_d_name, sizeof(parent_d_name), &parent_de->d_name);
+    if (parent_d_name.len == 0)
+    {
+        bpf_ringbuf_discard(data, 0);
+        return 0;
+    }
 
+    // Get Inode from file structure
     struct inode *inode_ptr = NULL;
     bpf_core_read(&inode_ptr, sizeof(inode_ptr), &file->f_inode);
     if (!inode_ptr)
@@ -51,23 +63,24 @@ static __always_inline int trace_file_operation(struct pt_regs *ctx, struct file
         return 0;
     }
 
-    u32 inode_num = 0;
-    bpf_core_read(&inode_num, sizeof(inode_num), &inode_ptr->i_ino);
+    // Get the current cgroup ID
+    int cgroup_id = bpf_get_current_cgroup_id();
 
-    struct inode_key key = {.inode = inode_num};
+    // Copy the data into the event structure
+    data->pid = bpf_get_current_pid_tgid() >> 32;
+    data->uid = bpf_get_current_uid_gid();
+    data->timestamp = bpf_ktime_get_ns();
+    data->cgroup_id = cgroup_id;
 
-    bpf_trace_printk("LOG: filename=%s otype=%s comm=%s\n", sizeof("LOG: filename=%s otype=%s comm=%s\n"), data->filename, data->otype, data->comm);
-    bpf_trace_printk("LOG: inode=%u\n", sizeof("LOG: inode=%u\n"), inode_num);
+    bpf_core_read_str(data->filename, sizeof(data->filename), d_name.name);
+    bpf_core_read_str(data->parent_filename, sizeof(data->parent_filename), parent_d_name.name);
+    bpf_core_read(&data->inode, sizeof(data->inode), &inode_ptr->i_ino);
+    __builtin_memcpy(data->otype, operation, sizeof(data->otype));
 
-    u32 *monitored = bpf_map_lookup_elem(&monitored_inodes, &key);
-    if (!monitored)
-    {
-        bpf_ringbuf_discard(data, 0);
-        return 0;
-    }
+    bpf_get_current_comm(&data->comm, sizeof(data->comm));
 
-    int cgroup_id = bpf_get_current_cgroup_id();
-    data->cgroup_id = cgroup_id;
+    bpf_trace_printk("LOG: filename=%s otype=%s comm=%s\n", sizeof("LOG: filename=%s otype=%s comm=%s\n"), data->filename, data->otype, data->comm);
+    bpf_trace_printk("LOG: inode=%u\n", sizeof("LOG: inode=%u\n"), data->inode);
 
     bpf_ringbuf_submit(data, 0);